CCM Malformed SIP Packet Denial of Service

[ilana_ilana]

Hello all,

Our client has recently installed CCM 11.0 and they found " Malformed SIP Packet Denial of Service " in their Cisco IPS.

On inquiry, we found that triggers are generating from 2 PC users (Desktop User) from network. System team are working to update the antivirus on effected PC but I want to assure from Call Manager side that is it safe enough to be NOT impacted with DOS attacks.

If its not what are the precautions to be followed to keep CCM secure ?

Regarding IPS, client has confirmed that IPS signatures are up to date.

[Mohammed Khan]

Hi ilana,

By default CUCM drop untrusted SIP signalling.However you can configured Secure SIP Trunk to add additional layer of security.

Procedure to configure Secure SIP trunk covered in below link.

https://supportforums.cisco.com/document/72956/cucm-sip-trunk-tls-configuration-and-troubleshooting

Regards,

Mohammed Noor

[ilana_ilana]

Hello Mohammed,

There is no SIP Trunk between cluster. There was SIP Trunk between CUCM and VG which has been shifted to H.323 now but SIP Trunk is not deleted yet from CUCM database. 

Several SIP Phones are added into CUCM recently.

Is it due to that SIP Trunk (between CUCM & VG) ?

Regards,

[Mohammed Khan]

SIP Trunk to VG should not Cause "Malformed SIP Packet Denial of Service". You can try deleting  SIP Trunk and check if that makes any difference since you have shift to H.323

[ilana_ilana]

Hello Mohammed,

We found that Malformed SIP Packet Denial of Service is coming from SIP Phones.

Any idea why SIP phones are behaving like this ?

Regards,

[Mohammed al Baqari]

Hi,

There are many aspects here:

1. Are the SIP clients on the PCs trying to reach your CUCM and getting blocked by IPS. I don't think so because Cisco SIP Clients are fully Complaint with Cisco Security Suite. You can check this if the IPS is configured to capture blocked packets

2. These might be 3rd Party SIP Clients which your users are using for personal voip calls. In this case, the alert isn't relevant to your CUCM

3. Your security team needs to dig deeper in the packets but my god feeling that its because of SIP client setting behind NAT device. When SIP Natted packets are seen by IPS they are most likely blocked because of mismatch between headers natted IP and SDP private IP. I have seen this widely.

4. Finally, its very important to make sure your CUCM subnet is well secured and I believe you need to look at CUCM security guide for this. But start with making sure that Data and CUCM shouldn't talk to each other